N0N Ransomware Gang: 10 Victims Posted in 24 Hours — Cross-Sector Campaign Analysis & Detection Engineering

Classification: TLP:AMBER | Report Date: 2026-09-19 | Analyst: Security Arsenal — From The Dark Side Intel Hub

Executive Summary

On 2026-09-18, the N0N ransomware operation published 10 victim organizations in a single 24-hour window to its dark web leak site — one of the most aggressive single-day disclosure bursts we have tracked from this group. The victims span eight countries (VE, SE, AR, US, TR, LU, BR, VN) and seven sectors, with a heavy concentration in financial services (3 of 10) and notable inclusion of critical infrastructure-adjacent targets: Venezuela's largest ISP (Inter), Argentina's Ministry of Education, AstraZeneca Türkiye, and the United Federation of Teachers.

This volume-and-breadth posting pattern is consistent with a mature double-extortion operation that has already completed the encryption phase and is now applying public pressure to non-paying victims. Organizations in the affected sectors should treat this as an active campaign window and immediately validate patch status against the CVEs N0N and affiliated access brokers are leveraging.

Threat Actor Profile — N0N

N0N operates a disciplined affiliate model: intrusion specialists hand off to encryption teams, and the leak site functions as the monetization pressure layer. The single-day mass posting is a deliberate intimidation tactic — it signals operational scale and shortens negotiation timelines for current victims.

Current Campaign Analysis

Sector Targeting

Geographic Concentration

Latin America and Southeast Asia are heavily represented (VE, AR, BR, VN), alongside high-value Western targets (US, SE, LU, TR). This pattern suggests N0N affiliates are opportunistically monetizing access across regions rather than running a geo-focused campaign — consistent with bulk-purchased access broker inventory and widespread scanning against unpatched edge devices.

Victim Profile

Victim size ranges from regional mid-market firms (Konnatus, Boundless TE) to enterprise-scale operations (AstraZeneca Türkiye, Transcom WorldWide, Inter). Estimated revenue range spans $5M to $500M+, indicating N0N does not enforce a minimum-revenue floor — it monetizes whatever access its affiliates obtain.

Posting Frequency & Escalation

A 10-victim single-day burst represents a significant escalation over typical N0N cadence. Two interpretations: (1) a batch of intrusions from the same access-acquisition cycle reached extortion deadline simultaneously, or (2) the group is deliberately front-loading publications to build brand pressure ahead of recruitment drives. Either way, the intrusion wave behind these postings occurred weeks ago — organizations should hunt for historical indicators, not just current ones.

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries are confirmed ransomware-associated and align with N0N's edge-device exploitation tradecraft:

• CVE-2026-59310 — Broadcom VMware vCenter path traversal. Direct path to virtualization-layer compromise and mass VM encryption. Patch immediately — this is the highest-impact vector in this set.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Trivially exploitable management-plane access.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Classic ransomware entry point; mirrors historical exploitation patterns of similar VPN flaws.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain vector relevant to the technology-sector victims.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal/RCE. Persistent favorite for MSP-adjacent access; likely relevant to the Transcom (outsourced support) compromise.

Assessment: The Transcom WorldWide victimization (an outsourced support provider for PayPal operations) is a hallmark access-broker/MSP-pivot scenario — ScreenConnect or VPN exploitation at a service provider, followed by downstream impact on the financial services client. Organizations consuming third-party support services must audit vendor remote-access tooling exposure today.

Detection Engineering

Sigma Rules

---
title: N0N Ransomware - Edge Device Exploitation Followed by Suspicious Child Process
id: 9a1f2c3e-4b5d-4e6f-8a7b-1c2d3e4f5a01
status: experimental
description: Detects web/VPN/firewall service processes spawning shells or scripting engines, consistent with post-exploitation behavior after CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), or ScreenConnect abuse seen in N0N campaigns.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
      - '\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate ScreenConnect technician sessions (tune by CommandLine and user context)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1219
---
title: N0N Ransomware - Pre-Encryption Shadow Copy and Backup Destruction
id: 9a1f2c3e-4b5d-4e6f-8a7b-1c2d3e4f5a02
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes — standard N0N pre-detonation playbook executed shortly before encryption.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'Delete Shadows'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbem:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing catalog maintenance
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: N0N Ransomware - Lateral Movement via PsExec or Remote WMI with Cobalt Strike Artifact Names
id: 9a1f2c3e-4b5d-4e6f-8a7b-1c2d3e4f5a03
status: experimental
description: Detects PsExec-style service execution, remote WMI process spawn, and named-pipe/service patterns commonly associated with Cobalt Strike beacons used by N0N affiliates for lateral movement and staging.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\psexec64.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_cs_service:
    CommandLine|contains:
      - '\\.\pipe\'
      - 'admin$'
    Image|endswith: '\rundll32.exe'
  condition: 1 of selection_*
falsepositives:
  - Administrative PsExec use by IT staff
  - SCCM/MECM remote task execution
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021
  - attack.t1047

KQL — Microsoft Sentinel Hunt Query (Pre-Ransomware Staging)

// N0N Campaign Hunt: data staging + lateral movement + pre-encryption indicators
// Lookback tuned to N0N's observed 5-14 day dwell time
let lookback = 14d;
let SuspiciousStaging =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("rclone.exe", "7z.exe", "rar.exe", "winscp.exe", "megacmd.exe", "filezilla.exe")
       or ProcessCommandLine has_any ("rclone copy", "rclone sync", "mega.nz", ".7z", "a -p", "vssadmin delete shadows", "wbadmin delete catalog", "bcdedit")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let LateralMovement =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemotePort in (445, 3389, 5985, 5986)
    | where InitiatingProcessFileName in~ ("wmiprvse.exe", "psexesvc.exe", "svchost.exe", "rundll32.exe")
    | summarize Connections = count(), Targets = dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
    | where Targets > 5; // fan-out behavior indicative of enumeration/lateral spread
SuspiciousStaging
| join kind=leftouter LateralMovement on DeviceName
| project StagingTime = Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Targets, Connections
| order by StagingTime desc;

Rapid-Response Audit Script

# N0N Rapid Triage - Run on suspected hosts + domain controllers
# Checks: new scheduled tasks (7d), shadow copy status, exposed RDP, suspicious services
$lookback = (Get-Date).AddDays(-7)
$report = @()

Write-Host "=== [1] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object {$_.Date -gt $lookback} |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | ForEach-Object {$_.Execute + ' ' + $_.Arguments}) -join '; '}}
$tasks | Format-Table -AutoSize
$report += $tasks

Write-Host "=== [2] Volume Shadow Copy Status (N0N deletes these pre-encryption) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies found - possible vssadmin deletion!" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "=== [3] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
Write-Host "RDP Enabled: $rdpEnabled | Port: $rdpPort"
if ($rdpEnabled) {
    Get-NetTCPConnection -LocalPort $rdpPort -State Listen -ErrorAction SilentlyContinue |
        Select-Object LocalAddress, LocalPort, State | Format-Table -AutoSize
}

Write-Host "=== [4] Suspicious Recently Installed Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {$_.PathName -match 'temp|appdata|psexesvc|\\users\\public'} |
    Select-Object Name, DisplayName, State, PathName, StartName | Format-List

Write-Host "=== [5] Recent Failed Logons (RDP brute force signature) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$lookback} -MaxEvents 2000 -ErrorAction SilentlyContinue |
    Group-Object {$_.Properties[19].Value} | Where-Object {$_.Count -gt 20} |
    Sort-Object Count -Descending | Select-Object Name, Count | Format-Table -AutoSize

Write-Host "Triage complete. Investigate any hits against N0N IOCs before proceeding." -ForegroundColor Green

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption Window)

N0N's typical 5–14 day dwell time gives defenders a detection window. Hunt for:

1. Mass compression/archive creation — 7-Zip/RAR executions against file shares, especially with password flags (a -p)
2. RClone or MEGA sync processes — N0N's preferred exfiltration tooling
3. vssadmin delete shadows / bcdedit / wbadmin delete catalog — final pre-detonation step; treat as a critical, page-the-on-call alert
4. PsExec service installation (PSEXESVC) across multiple hosts within a short window
5. WMI fan-out — WmiPrvSE.exe spawning shells on 5+ hosts
6. New local/domain admin accounts created outside change windows
7. Disabled AV/EDR services or unexpected MpPreference modifications

Critical Assets N0N Prioritizes for Exfiltration

Based on victimology in this campaign:

• Financial records and investor data (investment firms, fintech platforms — Argentem Creek, STOKR pattern)
• HR/payroll databases and PII (education and union targets — UFT pattern)
• Patient/clinical trial data (pharma subsidiaries — AstraZeneca Türkiye pattern)
• Customer databases and subscriber PII (ISP/telecom — Inter pattern)
• Legal case files (professional services — Konnatus pattern)
• Authentication stores — NTDS.dit, LSASS dumps, and IdP configurations are staged for both extortion leverage and downstream access sales

Containment Actions — Ordered by Urgency

1. Isolate, do not power off suspected hosts — preserve memory for forensic Cobalt Strike artifact recovery
2. Block egress to MEGA, RClone-remotes, and unknown cloud storage at the proxy/firewall immediately
3. Disable compromised accounts and force enterprise-wide credential resets, prioritizing privileged and service accounts
4. Segment backup infrastructure — verify offline/immutable backup integrity before any restoration planning
5. Revoke and reissue VPN/firewall management credentials if CVE-2026-50751 or CVE-2026-20316 exposure is confirmed
6. Engage IR retainer and legal/comms counsel before any attacker contact; do not negotiate directly

Hardening Recommendations

Immediate (24 Hours)

• Patch or isolate VMware vCenter (CVE-2026-59310), Cisco Secure FMC (CVE-2026-20316), Check Point gateways (CVE-2026-50751), and ConnectWise ScreenConnect (CVE-2024-1708). If patching is not possible today, pull the management interfaces off any routable path.
• Block RDP from the internet entirely; require VPN + MFA for all remote administration.
• Deploy the Sigma rules above to your SIEM and enable alerting on shadow copy deletion at critical severity.
• Egress-filter RClone, MEGA, and unsanctioned cloud storage destinations.
• Audit third-party support vendors for remote-access tooling exposure — the Transcom victimization shows N0N will enter through your MSP.

Short-Term (2 Weeks)

• Implement immutable/air-gapped backups with tested restoration runbooks; N0N explicitly targets backup catalogs pre-encryption.
• Enforce phishing-resistant MFA (FIDO2) on all VPN, email, and administrative access — N0N affiliates routinely replay phished credentials.
• Deploy LAPS and tiered administration to break lateral movement paths via shared local admin credentials.
• Enable Attack Surface Reduction rules blocking Office macro child processes and LSASS access.
• Stand up the KQL staging hunt as a scheduled analytics rule with a 14-day lookback matching N0N's dwell time.
• Conduct a tabletop exercise on double-extortion response — data-leak negotiation strategy must be decided before you need it.

This briefing is based on live dark web leak site monitoring via ransomware.live as of 2026-09-19. Victim claims by ransomware actors are not independently verified; inclusion indicates a public extortion claim, not confirmed breach impact.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub